[ Vendor · 458 CVEs ]
Apache Software Foundation
CVEs affecting Apache Software Foundation published in the last 30 days, plus any Apache Software Foundation CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-56154 | 1 Oct 2026 | CVSS 9.8 | Apache Software Foundation Apache HTTP ServerUse After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Server: from… | |
| CVE-2026-56449 | 1 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache HTTP ServerOut-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server… | |
| CVE-2026-48005 | 1 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache HTTP ServerMissing authentication checks in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an… | |
| CVE-2026-46729 | 1 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache HTTP ServerNULL Pointer Dereference vulnerability in Apache HTTP Servers mod_heartmonitor over unicast listener. This issue affects Apache HTTP Server: from… | |
| CVE-2026-47360 | 1 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache HTTP ServerExposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCookieRemove… | |
| CVE-2026-42356 | 1 Oct 2026 | CVSS 3.7 | Apache Software Foundation Apache HTTP ServerDeployment of wrong handler vulnerability in Apache HTTP Server allows the target of some internal redirects from CGI programs to also be treated as… | |
| CVE-2026-42528 | 1 Oct 2026 | CVSS 4.3 | Apache Software Foundation Apache HTTP ServerA memory calculation bug in mod_dav in Apache httpd 2.4.67 and earlier allows an attacker with permission to create WebDAV locks to crash server… | |
| CVE-2026-94250 | 1 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache APISIXAllocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can drive a… | |
| CVE-2026-94269 | 1 Oct 2026 | CVSS 6.3 | Apache Software Foundation Apache APISIXUse of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route overlaps a… | |
| CVE-2026-94276 | 1 Oct 2026 | CVSS 5.1 | Apache Software Foundation Apache APISIXImproper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authorization… | |
| CVE-2026-94212 | 1 Oct 2026 | CVSS 6.4 | Apache Software Foundation Apache APISIXImproper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on every… | |
| CVE-2026-94220 | 1 Oct 2026 | CVSS 2.1 | Apache Software Foundation Apache APISIXCross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user to click a… | |
| CVE-2026-82806 | 1 Oct 2026 | CVSS 5.3 | Apache Software Foundation Apache APISIXExposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under a… | |
| CVE-2026-88789 | 1 Oct 2026 | CVSS 8.6 | Apache Software Foundation Apache Camel QuarkusImproper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus from 3.2.0… | |
| CVE-2026-78242 | 1 Oct 2026 | CVSS 5.7 | Apache Software Foundation Apache APISIXInsertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unmasked header value to be written… | |
| CVE-2026-95616 | 30 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache WSS4JAn integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message… | |
| CVE-2026-89238 | 30 Sep 2026 | CVSS 9.1 | Apache Software Foundation Apache WSS4JWSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect… | |
| CVE-2026-92121 | 30 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache WSS4JIn the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag… | |
| CVE-2026-92899 | 30 Sep 2026 | CVSS 4.8 | Apache Software Foundation Apache WSS4JApache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but… | |
| CVE-2026-87830 | 30 Sep 2026 | CVSS 9.1 | Apache Software Foundation Apache WSS4JIn the StAX streaming WS-SecurityPolicy validator, certain relative or unsupported XPath expressions can be converted into paths that never match the… | |
| CVE-2026-88920 | 30 Sep 2026 | CVSS 9.8 | Apache Software Foundation Apache WSS4JAn authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages… | |
| CVE-2026-85532 | 30 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache WSS4JApache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak keys or… | |
| CVE-2026-94029 | 30 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache MINA SSHDServer-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6… | |
| CVE-2026-94052 | 30 Sep 2026 | CVSS 9.1 | Apache Software Foundation Apache MINA SSHDA missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 bypassed… | |
| CVE-2026-94053 | 30 Sep 2026 | CVSS 9.1 | Apache Software Foundation Apache MINA SSHDAuthentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA… | |
| CVE-2026-77185 | 30 Sep 2026 | CVSS 9.1 | Apache Software Foundation Apache MINA SSHDAuthentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5 for a certain (presumed rare) way to… | |
| CVE-2026-93994 | 30 Sep 2026 | CVSS 8.1 | Apache Software Foundation Apache MINA SSHDApache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication schemes, for… | |
| CVE-2026-93995 | 30 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache MINA SSHDImproper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java library for… | |
| CVE-2026-93996 | 30 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache MINA SSHDUncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java… | |
| CVE-2026-94002 | 30 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache MINA SSHDPossible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0-M1 to… | |
| CVE-2026-102509 | 30 Sep 2026 | CVSS 8.7 | Apache Software Foundation Apache PLC4XMemory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache… | |
| CVE-2026-102510 | 30 Sep 2026 | CVSS 8.7 | Apache Software Foundation Apache PLC4XInteger Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation… | |
| CVE-2026-102511 | 30 Sep 2026 | CVSS 8.5 | Apache Software Foundation Apache PLC4XImproper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker… | |
| CVE-2026-102508 | 30 Sep 2026 | CVSS 9.2 | Apache Software Foundation Apache PLC4XImproper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an attacker… | |
| CVE-2026-97395 | 29 Sep 2026 | CVSS 8.1 | Apache Software Foundation Apache PolarisApache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as… | |
| CVE-2026-71898 | 29 Sep 2026 | CVSS 4.3 | Apache Software Foundation Apache DolphinSchedulerAn incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a workflow… | |
| CVE-2026-71899 | 29 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache DolphinSchedulerA missing authorization vulnerability exists in the `query-dynamic-sub-workflows` API of Apache DolphinScheduler. The API does not properly verify… | |
| CVE-2026-78214 | 29 Sep 2026 | CVSS 5.3 | Apache Software Foundation Apache DolphinSchedulerAn authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is required… | |
| CVE-2026-81569 | 29 Sep 2026 | CVSS 4.3 | Apache Software Foundation Apache DolphinSchedulerAn improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to access a… | |
| CVE-2026-71897 | 29 Sep 2026 | CVSS 4.3 | Apache Software Foundation Apache DolphinSchedulerAn improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to operate on… | |
| CVE-2026-82804 | 29 Sep 2026 | CVSS 8.8 | Apache Software Foundation Apache DolphinSchedulerThe scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command… | |
| CVE-2026-66083 | 29 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache DolphinSchedulerThe /datasources/unauth-datasource endpoint does not properly enforce data source authorization. An authenticated user can invoke this endpoint to… | |
| CVE-2026-102495 | 29 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache XMLSchemaApache XmlSchema doesn't limit how deeply schema imports and includes can be nested, so a malicious schema can make parsing recurse until the stack… | |
| CVE-2026-102496 | 29 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache XMLSchemaApache XmlSchema doesn't limit how deeply schema structures can be nested when it builds its schema model, so a malicious schema can make parsing… | |
| CVE-2026-102497 | 29 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache XMLSchemaThe Apache XmlSchema walker (xmlschema-walker) doesn't detect cycles in type derivation, substitution groups, model groups or attribute groups. A… | |
| CVE-2026-81862 | 29 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache Airflow Teradata providerApache Airflow's Teradata provider embedded cloud storage credentials directly into SQL statements. `S3ToTeradataOperator` and… | Fix |
| CVE-2026-81914 | 29 Sep 2026 | CVSS 4.3 | Apache Software Foundation Apache Airflow Google providerApache Airflow's Google provider built Google Drive search expressions by interpolating file and folder names directly into single-quoted string… | Fix |
| CVE-2026-81930 | 29 Sep 2026 | CVSS 6.3 | Apache Software Foundation Apache Airflow Snowflake providerApache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The… | Fix |
| CVE-2026-86843 | 29 Sep 2026 | CVSS 6.3 | Apache Software Foundation Apache Airflow Teradata providerThe Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them… | Fix |
| CVE-2026-91048 | 29 Sep 2026 | CVSS 9.8 | Apache Software Foundation Apache KarafThe jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a command… | |
| CVE-2026-91085 | 29 Sep 2026 | CVSS 6.3 | Apache Software Foundation Apache KarafApache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl.<scope>.cfg)… | |
| CVE-2026-92142 | 29 Sep 2026 | CVSS 8.8 | Apache Software Foundation Apache KarafApache Karaf exposes a JMX MBeanServer guarded by KarafMBeanServerGuard, which enforces role-based access control (RBAC) on MBean operations invoked… | |
| CVE-2026-91012 | 29 Sep 2026 | CVSS 9.8 | Apache Software Foundation Apache Karaforg.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell commands… | |
| CVE-2026-91006 | 28 Sep 2026 | CVSS 8.8 | Apache Software Foundation Apache KarafApache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation… | |
| CVE-2026-90979 | 28 Sep 2026 | CVSS 7.3 | Apache Software Foundation Apache KarafLDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and… | |
| CVE-2026-86507 | 28 Sep 2026 | CVSS 6.1 | Apache Software Foundation Apache RollerImproper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can execute… | |
| CVE-2026-91206 | 28 Sep 2026 | CVSS 6.1 | Apache Software Foundation Apache RollerImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform… | |
| CVE-2026-82382 | 28 Sep 2026 | CVSS 6.1 | Apache Software Foundation Apache RollerImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform… | |
| CVE-2026-82383 | 28 Sep 2026 | CVSS 8.2 | Apache Software Foundation Apache RollerMissing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-global… | |
| CVE-2026-82384 | 28 Sep 2026 | CVSS 9.8 | Apache Software Foundation Apache RollerDeserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserialization of attacker-controlled… | |
| CVE-2026-82385 | 28 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache RollerExposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the application… | |
| CVE-2026-82386 | 28 Sep 2026 | CVSS 7.7 | Apache Software Foundation Apache RollerImproper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Roller… | |
| CVE-2026-82387 | 28 Sep 2026 | CVSS 5.4 | Apache Software Foundation Apache RollerImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with media-upload rights to… | |
| CVE-2026-82546 | 28 Sep 2026 | CVSS 6.1 | Apache Software Foundation Apache RollerImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker… | |
| CVE-2026-91204 | 28 Sep 2026 | CVSS 6.1 | Apache Software Foundation Apache RollerImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to… | |
| CVE-2026-82375 | 28 Sep 2026 | CVSS 7.4 | Apache Software Foundation Apache RollerServer-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbound HTTP… | |
| CVE-2026-82376 | 28 Sep 2026 | CVSS 7.7 | Apache Software Foundation Apache RollerImproper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on a weblog to cause the server… | |
| CVE-2026-82377 | 28 Sep 2026 | CVSS 9.9 | Apache Software Foundation Apache RollerMissing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs… | |
| CVE-2026-82378 | 28 Sep 2026 | CVSS 9.0 | Apache Software Foundation Apache RollerIncorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns an… | |
| CVE-2026-82379 | 28 Sep 2026 | CVSS 7.7 | Apache Software Foundation Apache RollerAuthentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it… | |
| CVE-2026-82380 | 28 Sep 2026 | CVSS 8.1 | Apache Software Foundation Apache RollerCross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing actions under… | |
| CVE-2026-82381 | 28 Sep 2026 | CVSS 5.4 | Apache Software Foundation Apache RollerImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with authoring rights on a… | |
| CVE-2026-82348 | 28 Sep 2026 | CVSS 7.7 | Apache Software Foundation Apache RollerAuthorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read… | |
| CVE-2026-92550 | 25 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache Qpid Broker-JA pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This… | |
| CVE-2026-92560 | 25 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache Qpid Broker-JA pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This… | |
| CVE-2026-92564 | 25 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache Qpid Broker-JA pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects… | |
| CVE-2026-92573 | 25 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache Qpid Broker-JImproper handling of compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion… | |
| CVE-2026-92608 | 25 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache Qpid Broker-JImproper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disrupt… | |
| CVE-2026-92609 | 25 Sep 2026 | CVSS 9.8 | Apache Software Foundation Apache Qpid Broker-JSession fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an authenticated management session via… | |
| CVE-2026-97636 | 24 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache Airflow HashiCorp providerApache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team… | |
| CVE-2026-57590 | 24 Sep 2026 | CVSS 8.1 | Apache Software Foundation Apache DolphinSchedulerA missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the… | |
| CVE-2026-86246 | 23 Sep 2026 | CVSS 9.1 | Apache Software Foundation Apache Tomcat NativeInitialization of a resource with an insecure default vulnerability in Apache Tomcat Native enabled insecure options by default including… | |
| CVE-2026-86247 | 23 Sep 2026 | CVSS 7.4 | Apache Software Foundation Apache Tomcat NativeRace condition within a thread vulnerability in Apache Tomcat Native allowed client certificate verification requirements to be down-graded for some… | |
| CVE-2026-86243 | 23 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache Tomcat NativeBuffer over-read vulnerability in Apache Tomcat Native during the TLS handshake permits a malicious user to trigger a DoS via a JVM crash. This issue… | |
| CVE-2026-86248 | 23 Sep 2026 | CVSS 9.8 | Apache Software Foundation Apache TomcatCLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This issue affects… | |
| CVE-2026-86350 | 23 Sep 2026 | CVSS 9.1 | Apache Software Foundation Apache TomcatInconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for… | |
| CVE-2026-87022 | 23 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache TomcatImproper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-deflate is… | |
| CVE-2026-78383 | 23 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache TomcatAllocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing… | |
| CVE-2026-78437 | 23 Sep 2026 | CVSS 7.3 | Apache Software Foundation Apache TomcatIncomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user… | |
| CVE-2026-79677 | 23 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache TomcatMissing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a… | |
| CVE-2026-73581 | 23 Sep 2026 | CVSS 6.5 | Apache Software Foundation Apache TomcatImproper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when… | |
| CVE-2026-75973 | 23 Sep 2026 | CVSS 7.3 | Apache Software Foundation Apache TomcatImproper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default… | |
| CVE-2026-76183 | 23 Sep 2026 | CVSS 9.8 | Apache Software Foundation Apache TomcatAuthentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed… | |
| CVE-2026-77756 | 23 Sep 2026 | CVSS 3.7 | Apache Software Foundation Apache TomcatInconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the… | |
| CVE-2026-77762 | 23 Sep 2026 | CVSS 8.1 | Apache Software Foundation Apache TomcatConcurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacker to… | |
| CVE-2026-77791 | 23 Sep 2026 | CVSS 7.5 | Apache Software Foundation Apache TomcatUncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue affects… | |
| CVE-2026-91928 | 23 Sep 2026 | CVSS 6.1 | Apache Software Foundation Apache Sling XSSImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache… | |
| CVE-2026-91999 | 23 Sep 2026 | CVSS 6.1 | Apache Software Foundation Apache Sling XSSImproper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache… | |
| CVE-2026-92001 | 23 Sep 2026 | CVSS 6.1 | Apache Software Foundation Apache Sling XSSImproper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects Apache… | |
| CVE-2026-94243 | 23 Sep 2026 | CVSS 7.3 | Apache Software Foundation Apache Sling Security BundleA vulnerability in Apache Sling Security Bundle: the ReferrerFilter accepts weaker-than-orgin evidence. This issue affects Apache Sling Security… |
Page 4 of 5